Security
DeepsecBench: evaluating model performance in finding cybersecurity vulnerabilities
DeepsecBench evaluates model performance in finding security vulnerabilities.
Malte Ubl, Eric Dodds
Security
Featured articles
- Security
Security boundaries in agentic architectures
Most agents today run generated code with full access to your secrets. As more agents adopt coding agent patterns, where they read filesystems, run shell commands, and generate code, they're becoming multi-component systems that each need a different level of trust. While most teams run all of these components in a single security context, because that's how the default tooling works, we recommend thinking about these security boundaries differently. Below we walk through: The actors in agentic systems Where security boundaries should go between them An architecture for running agent and generated code in separate contexts All agents are starting to look like coding agents More agents are adopting the coding agent architecture. These agents read and write to a filesystem. They run bash, Python, or similar programs to explore their environment. And increasingly, agents generate code to solve particular problems. Even agents that aren't marketed as "coding agents" use code generation as
Malte Ubl, Harpreet Arora - Security
How we run Vercel's CDN in front of Discourse
Vercel's CDN can front any application, not just those deployed natively on the platform, and it's simple to set up. This allows you to add firewall protection, DDoS mitigation, and observability to platforms like Discourse or WordPress without migrating them completely. The Vercel Community is an example of this architecture. It is a Discourse application hosted elsewhere, but we proxy it ourselves via Vercel's CDN, which both protects the app and gives us access to useful features in Vercel's website stack: Web Analytics gives us anonymized, cookie-free demographic and referrer data, so we can see where users are coming from and what they're looking for. Firewall gives us DDoS protection and has automatically prevented several attacks in the last year. Bot Management lets us block malicious scrapers while allowing trusted crawlers to index the forum and allow community posts to show up in ChatGPT searches. Some parts of the community platform, like Vercel Community live sessions, ru
Jacob ParisDX Engineer
Blog posts
- Security
DeepsecBench: evaluating model performance in finding cybersecurity vulnerabilities
Malte Ubl, Eric Dodds - Security
How we run Vercel's CDN in front of Discourse
Jacob ParisDX Engineer - Security
Security boundaries in agentic architectures
Malte Ubl, Harpreet Arora - Security
The Vercel OSS Bug Bounty program is now available
Andy RianchoPrincipal Security Engineer - Security
Our $1 million hacker challenge for React2Shell
Malte UblCTO, Vercel - Security
Security through design: Creating the improved Firewall experience
Sage Abraham, Liz Hurder, and 3 others - Security
Vercel achieves TISAX AL2 compliance to serve automotive partners
Kacee TaylorHead of Governance, Risk & Compliance (GRC) - Security
Critical npm supply chain attack response – September 8, 2025
Aaron BrownHead of Security - Security
The three types of AI bot traffic and how to handle them
Kevin CorbettSoftware Engineer - Security
Vercel security roundup: improved bot defenses, DoS mitigations, and insights
Liz Hurder, Kevin Corbett - Security
Bot Protection: One-click managed ruleset now in public beta
Malavika Tadeusz, Liz Hurder - Security
Protectd: Evolving Vercel’s always-on denial-of-service mitigations
Casey Gowrie, Joe Haddad
